CVE-2024-10190
NONE EPSS 59.1%
Published Mar 20, 20251y ago · Modified Jun 17, 20262w ago
Published Mar 20, 2025 1y ago
Last Modified Jun 17, 2026 2w ago
Description
Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the `ElasticRendezvousHandler`, a subclass of `KVStoreHandler`. Specifically, the `_put_value` method in `ElasticRendezvousHandler` calls `codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.
Threat Intelligence
EPSS Exploit Probability
59.1% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 1
CWE-502 Deserialization of Untrusted Data Validation
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| horovod | horovod | * | ≤0.28.1 |
References 1
- huntr.com https://huntr.com/bounties/3e398d1f-70c2-4e05-ae22-f5d66b19a754
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.